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Abstract —We investigate cascades in networks consisting of 
strategic agents with interdependent security. We assume that the 
strategic agents have choices between i) investing in protecting 
themselves, ii) purchasing insurance to transfer (some) risks, and 
iii) taking no actions. Using a population game model, we study 
how various system parameters, such as node degrees, infection 
propagation rate, and the probability with which infected nodes 
transmit infection to neighbors, affect nodes’ choices at Nash 
equilibria and the resultant price of anarchy/stability. In addition, 
we examine how the probability that a single infected node 
can spread the infection to a significant portion of the entire 
network, called cascade probability, behaves with respect to 
system parameters. In particular, we demonstrate that, at least 
for some parameter regimes, the cascade probability Increases 
with the average degree of nodes. 

Index Terms —Cascade, contagion, interdependent security, 
population game, price of anarchy. 

I. Introduction 

Recently, the topic of interdependent security (IDS) im 
has gained much attention from research communities. IDS 
arises naturally in many areas including cybersecurity, airline 
security, and smart power grid, just to name a few. Ensuring 
adequate security of such critical infrastructure and systems 
has emerged as one of most important engineering and societal 
challenges today. 

There are several key difficulties in tackling IDS in large 
networks. First, as the name suggests, the security of individual 
entities is dependent on those of others. Second, these entities 
are often strategic and are interested only in their own objec¬ 
tives with little or no regards for the well being of the others. 
Third, any attempt to capture and study detailed interactions 
among a large number of (strategic) entities suffers from the 
curse of dimensionality. 

Although there are no standard metrics on which experts 
agree for measuring or quantifying system-level security, one 
popular approach researchers take to measure the security of a 
network is to see how easily an infection can spread through a 
network. In particular, researchers often study the probability 
with which an infection will propagate to a significant or 
nonnegligible fraction of the network, starting with a single 
infected node in the network, which we call cascade proba¬ 
bility. 

We study the cascade probability in a network composed 
of strategic agents or nodes representing, for instance, orga¬ 
nizations (e.g., companies) or network domains. The edges in 
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the network are not necessarily physical edges. Instead, they 
could be logical, operational or relational edges (e.g., business 
transactions or information sharing). The degree of a node is 
dehned to be the number of neighbors or incident edges it has 
in the networkf] 

In our setting, there are malicious entities, called attackers, 
which launch attacks against the nodes in the network, for 
example, in hopes of infecting the machines or gaining unau¬ 
thorized access to information of victims. Moreover, when the 
attacks are successful, their victims also unknowingly launch 
indirect attacks on their neighbors. For this reason, when a 
node is vulnerable to attacks, it also heightens the risk of its 
neighbors as well, thereby introducing a negative network ex¬ 
ternality and influencing the choices of its neighbors. Network 
externality is also known as network effect ll38l . 

Faced with the possibility of being attacked either directly 
by malicious attackers or indirectly by their neighbors, nodes 
may hnd that it is in their own interests to invest in protecting 
themselves against possible attacks, e.g., hrewalls, network 
intrusion detection tools, incoming traffic monitoring, etc. 
Moreover, they may also consider purchasing insurance to 
mitigate their financial losses in case they fall victim to 
successful attacks. To capture these choices available to nodes, 
in our model each node can select from three admissible 
actions - Protection (P), Insurance (!) and No Action {N). 
When a node picks N, it assumes all of the risk from damages 
or losses brought on by successful attacks. 

In practice, a node may be able to both invest in protecting 
itself and purchase insurance at the same time. However, 
because insurance merely transfers risk from the insured to 
the insurer, a purchase of insurance by a node that also invests 
in protection does not affect the preferences of other nodes. 
Therefore, not modeling the possibility of simultaneous invest¬ 
ment in protection and insurance by a node does not change 
other nodes’ decisions to protect themselves. Moreover, both 
overall social costs, i.e., the sum of losses due to attacks and 
investments in protection, and cascade probability depend only 
on which nodes elect to invest in protection. Therefore, leaving 
out the choice of simultaneous protection and insurance does 
not alter our main findings on the price of anarchy/stability 
(POA/POS) II 20 I and cascade probability, which are explained 
shortly. 

As mentioned earlier, a major hurdle to studying IDS in a 
large network consisting of many nodes is that it is difficult, if 
not impossible, to model the details of interactions among all 
nodes. To skirt this difficulty, we employ a population game 

*We assume that the network is modeled as an undirected graph in the 
paper. If the network was modeled as a directed graph instead, the degree 
distribution of players we are interested in would be that of in-degrees. 
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model lll5]l . A population game is often used to model the 
interactions between many players, possibly from different 
populations. While the population game model is clearly a 
simplification of a complicated reality, we believe that our 
findings based on this scalable model offer helpful insights 
into more realistic scenarios. 

For our study, we adopt a well known solution concept, 
Nash equilibrium (NE) of the population game, as an approxi¬ 
mation to nodes’ behavior in practice. Our goal is to investigate 
how the network effects present in IDS shape the POA/POS 
and cascade probability as different system parameters (e.g., 
node degree distribution and infection propagation rate) are 
varied. 

The POA (resp. POS) is defined to be the largest (resp. 
smallest) ratio between the social cost at an NE and the 
smallest achievable social cost. The POS can be viewed as 
the minimum price one needs to pay for stability among the 
players so that no player would have an incentive to deviate 
from its strategy unilaterally. Both POS and POA have recently 
gained much attention as a means to measure the inefficiency 
of NEs for different games (e.g., 1201 . ifSTl . If3^ ). 

Our main findings and contributions can be summarized as 
follows: 

1) There exists a threshold on degree of populations so 
that only the populations with degree greater than or 
equal to the threshold invest in protection. This degree 
threshold decreases with an increasing propagation rate 
of infection and the probability of indirect attacks on 
neighbors. 

2) In general, there may not be a unique NE of a population 
game. However, the size of each population investing 
in protection is identical at all NEs. Consequently, the 
overall social cost and cascade probability are the same 
for all NEs, and the POA and the POS are identical. 

3) We provide an upper bound on the POA/POS, which 
is a function of the average degree of populations and 
increases superlinearly with the average degree in many 
cases. Moreover, it is tight in the sense that we can find 
scenarios for which the POA is equal to the bound. 

4) In many cases, the population size investing in protection 
tends to climb with the average degree, the infection 
propagation rate, and the probability of indirect attack 
on neighbors. Somewhat surprisingly, the cascade prob¬ 
ability also increases at the same time as the average 
degree or indirect attack probability rises. 

We suspect that this observation is a consequence of 
the following: As more of the population invests in 
protection, it produces higher positive network external¬ 
ities on other unprotected nodes. These greater positive 
externalities in turn cause/ree riding by some nodes with 
larger degrees which would have chosen to protect when 
the parameters were smaller. These vulnerable nodes 
with larger degrees then provide better venues for an 
infection to spread, escalating the cascade probability 
as a result. 

We point out that our analysis of cascades is carried out 
under a simplifying assumption that local neighborhoods of 
nodes are tree-like. While this assumption is reasonable for 


sparse networks, it may not hold in some of real-world 
networks that have been shown to exhibit much stronger local 
clustering than many of random graph models 1^ . Il43l . Eor 
such networks with higher clustering among neighbors and 
cycles in local neighborhoods, our findings may not be directly 
applicable. 

In addition, we note that actual security investments in 
practice will likely vary considerably from one realized net¬ 
work to another, even when the node degrees are identical. 
Moreover, in some cases, the exact network topology may be 
unknown and hard to obtain. Eor these reasons, it is difficult 
and, perhaps, uninformative to study the effects of node degree 
distribution on the basis of a limited number of random 
networks. Instead, we aim to capture the mean behavior of 
nodes without fixing the network topology. It is our hope that 
even this simple model will help us understand the qualitative 
nature of aggregate behavior of nodes and shed some light on 
how the underlying structure of interdependency in security 
shapes their security decisions and resulting network-level 
security in more realistic settings. 

To the best of our knowledge, our work presented here 
(along with ll22ll . in which we explore local network security 
seen by individual nodes and a structural relation between 
an NE and a social optimum) is the first study to investigate 
the effects of network properties and other system parameters 
on interdependent security in networks of strategic entities. 
Although our study is based on a population game model that 
does not capture microscopic strategic interactions among indi¬ 
vidual nodes, we believe that it approximates the macroscopic 
behavior of the nodes and our findings shed some light on how 
the underlying network topology and other system parameters 
may influence the choices of nodes in practice and shape the 
resulting network security. 

The rest of the paper is organized as follows. We summarize 
some of most closely related studies in Section Section 
[In] outlines the population game model we adopt for our 
analysis and presents the questions of interest to us. Section 
jlV] discusses our main analytical results on the properties of 
NEs and the POA/POS, which are complemented by numerical 
results in Section El We conclude in Section Ell 

II. Related literature 

Due to a large volume of literature related to security and 
cascades of infection, an attempt to summarize the existing 
studies will be an unproductive exercise. Instead, we only 
select several key studies that are most relevant to our study 
and discuss them briefly. Eurthermore, for a summary of 
related literature on IDS, we refer an interested reader to 122, 
||25]| and references therein. Here, we focus on the literature 
related to cascades and contagion. 

Eirst, Watts in his seminal paper Il44l studied the following 
question: Consider a network with n nodes whose degree 
distribution is given by p = (p^; k G S+), where := 
{0,1,2,...}. Suppose that we randomly choose a single node 
and infect it. Given this, what is the probability that a large 
number of nodes will be infected, starting with the single 
infected node, i.e., there is a (global) cascade of infection? 
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Obviously, the answer to this question depends on how the 
infection spreads. In Watts’ model, each node i has a random 
threshold 0^ G [0,1], and it becomes infected once the fraction 
of its neighbors that are infected exceeds 0^. 

In his analysis, rather than deriving a global cascade con¬ 
dition for hnite networks, he considers an inhnite network 
in which each node has degree k with probability pk, inde¬ 
pendently of others. Using a generating function approach, 
he then studies the condition under which the largest cluster 
of vulnerable nodes percolates, which he calls the cascade 
condition. Here, a node is vulnerable if its threshold is smaller 
than the inverse of its degree. 

A somewhat surprising hnding in his study is that as the 
average or mean degree of nodes increases, the network goes 
through two critical (phase) transitions: Initially, when the 
average degree is very small, the network is stable in that 
the cascade probability is (near) zero. As the average degree 
climbs, after the hrst transition the network experiences cas¬ 
cades with nonnegligible probability. However, as the average 
degree rises further, at some point, the network becomes stable 
again and cascades do not occur frequently, i.e., the cascade 
probability becomes very small once again. 

Gleeson and Cahalane M extended the work of Watts. 
In their model, they assumed that a certain fraction of total 
population is infected at the beginning, and showed that the 
existence of cascades exhibits high sensitivity to the size of 
initially infected population. 

Coupechoux and Lelarge examined the influence of cluster¬ 
ing in social networks on diffusions and contagions in random 
networks 021,1111. In particular, they proposed a new random 
graph model where some nodes are replaced by cliques of 
size equal to the degrees of the nodes. Their key findings 
include the observation that, in the symmetric threshold model, 
the effects of clustering on contagion threshold depend on 
the mean node degree; for small mean degrees, clustering 
impedes contagion, whereas for large mean degrees, contagion 
is facilitated by clustering. 

An observation similar to Watts’ hnding has been reported 
in different helds, including hnancial markets where banks 
and hnancial institutions (FIs) are interconnected through their 
overlapping investment portfolios and other (credit) exposures 
||2l . 161 . 171 . ifTSl . In a simple model lb), two FIs are connected 
if they share a common asset in their investment portfolios, and 
the average degree of FIs depends on the number of available 
assets and how diverse their portfolios are, i.e., how many 
assets each FI owns. An interesting hnding is that when the 
number of overlapping assets of FIs is small, the market is 
stable in that it can tolerate a failure of a few FIs without 
affecting other FIs signihcantly. As they begin to diversify 
their portfolios and spread their investments across a larger set 
of assets, the market becomes unstable in that a failure of even 
one or two FIs triggers a domino effect, causing many other 
FIs to collapse shortly after. However, when they diversify 
their investment portfolios even further and include a very 
large set of assets, the market becomes stable again. 

Watts’ model has also been extended to scenarios where 
nodes are connected by more than one type of network, e.g., 
social network vs. professional network Q, na. For example. 


Yagan and Gligor ll45l investigated scenarios where nodes are 
connected via two or more networks with varying edge-level 
inhuence. In their model, each node switches from “good” to 
“infected” when Ci ■ rrii /Ci ■ ki exceeds some threshold, 
where ki and rrii are the total number of neighbors and infected 
neighbors, respectively, of the node in the ith network, and Ci 
reflects the relative influence of the edges in the ith network. 
Their main finding related to the impact of average degree is 
similar in nature to that of Watts IB). 

In another related study, Beale et al. 121 studied the behavior 
of strategic banks interested in minimizing their own probabil¬ 
ities of failure. They showed that banks can lower own proba¬ 
bility of failure by diversifying their risks and spreading across 
assets. But, if banks follow similar diversihcation strategies, it 
can cause a (nearly) simultaneous collapse of multiple banks, 
thereby potentially compromising the stability of the whole 
hnancial market. This hnding points to a tension between the 
stability of individual banks and that of the hnancial system. 
Although the authors did not attempt to quantify the loss of 
stability, this degradation in system stability is closely related 
to well known inefficiency of NEs IIT4l . lISTI . Il33l . 

We point out an important difference between the hndings 
in the studies by Watts and others 0, Q, IBl and ours: In 
our model, the nodes are strategic and can actively protect 
themselves when it is in their own interests to do so. In 
such scenarios, as the average degree increases, in many cases 
the network becomes more vulnerable in that the cascade 
probability rises despite that more nodes protect themselves 
(Section 0. This somewhat counterintuitive observation is a 
sharp departure from the hndings of ll44l . Il45l . 

This discrepancy is mainly caused by the following. In the 
model studied by Watts and others, the thresholds of nodes are 
given by independent and identically distributed (i.i.d.) random 
variables (rvs), and their distribution does not depend on the 
average degree or node degrees. Due to this independence of 
the distribution of thresholds on degrees, as the average degree 
increases, a larger number of neighbors need to be infected 
before a node switches to an “infected” state. For this reason, 
nodes become less vulnerable. Since only a single node is 
infected at the beginning, diminishing vulnerability of nodes 
makes it harder for the infection to propagate to a large portion 
of the network. 

In contrast, in a network comprising strategic players with 
heterogeneous degrees, at least for some parameter regimes, 
we observe free riding by nodes with smaller degrees. A 
similar free riding is also observed in the context of informa¬ 
tion reliability ll40) . Interestingly, as we show in Section 
when the average degree rises, both the fraction of protected 
population and the degree threshold mentioned in Section |I] 
tend to climb, at least in some parameter space of interest 
(Section [V|. 

We suspect that the upturn in degree threshold is a con¬ 
sequence of stronger positive network externalities produced 
by the investments in protection by an increasing number of 
higher degree nodes; greater positive externalities cause some 
nodes with larger degrees, which would protect themselves 
when the average degree was smaller, to free ride instead. As 
stated in Section |Ij these unprotected nodes with increasing 


IV 
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degrees allow an initial infection to propagate throughout the 
network more easily, leading to larger cascade probability. 

In lEa, we carry out a related study with some emphasis 
on cybersecurity. However, its model is different from that 
employed here: ll22ll assumes that infections spread only 
to immediate neighbors, whereas the current model allows 
infections to transmit multiple hops. On the other hand, instead 
of binary security choices assumed here, in ll22ll we allow M 
(M > 1) different protection levels nodes can select from, in 
order to capture varying cybersecurity measures they can pick. 
Also, an insurer may require a minimum level of protection 
before a node can purchase insurance, and the insurance 
premium may depend on the node’s protection level. 

More importantly, besides the differences in their models, 
there are major disparities in the main focus and key findings 
of these two studies. While both studies aim to understand 
how network security is influenced by system parameters, we 
examine in network security from the viewpoint of a node 
with a fixed degree as the node degree distribution varies. 
A main finding of ll22l is that, as the degree distribution 
of neighbors becomes (stochastically) larger, under a set of 
assumptions, the average risk seen from neighbors tends to 
diminish at NEs. In this sense, from the standpoint of a node 
with a fixed degree, the network security improves and, as a 
result, the security investments of nodes with a fixed degree 
decline. Finally, Il22]l also investigates the structural relation 
between an NE and a social optimum that minimizes the 
overall social cost, with the goal of identifying a possible 
means of internalizing the externalities produced by nodes 

BD. 

III. Model and problem formulation 

The node^ in a network representing private companies 
or organizations are likely to be interested only in their own 
objectives. Thus, we assume that they are strategic and model 
their interactions as a noncooperative game, in which players 
are the nodes in the network. 

We focus on scenarios where the number of nodes is 
very large. Unfortunately, as stated before, modeling detailed 
interactions among many nodes and analyzing ensuing games 
is challenging, if possible at all. A main difficulty is that the 
number of possible strategy profiles we need to consider grows 
exponentially with the number of players, and characterizing 
the NEs of games is often demanding even with a modest 
number of players. Moreover, even when the NEs can be 
computed, it is often difficult to draw insight from them. 

For analytical tractability, we employ a population game 
model lf35l . Population games provide a unified framework and 
tools for studying strategic interactions among a large number 
of agents under following assumptions llTSl . First, the choice of 
an individual agent has very little effect on the payoffs of other 
agents. Second, there are finitely many populations of agents, 
and each agent is a member of exactly one population. Third, 
the payoff of each agent depends only on the distribution of 
actions chosen by members of each population. In other words, 

^We will use the words nodes and players interchangeably in the remainder 
of the manuscript. 


if two agents belonging to the same population swap their 
actions, it does not change the payoffs of other agents. For a 
detailed discussion of population games, we refer an interested 
reader to the manuscript by Sandholm llTSl . 

Our population game model does not capture the micro¬ 
scopic edge level interactions between every pair of neighbors. 
Instead, it attempts to capture the mean behavior of nodes 
with varying degrees, without assuming any given network. 
An advantage of this model is that it provides a scalable 
model that enables us to study the effects of various system 
parameters on the overall system security regardless of the 
network size. Moreover, the spirit behind our population game 
model is in line with that of Watts’ model m and its 
extensions (e.g., m, E3). 

The notation we adopt throughout the paper is listed in 
Table U 


A 

(pure) action space (^4 = {/, A^, P\) 

C 

cost function of population game 

Cd,„(x) 

cost of a node from pop. d playing action a 

V 

set of node degrees (I? = {1, 2,..., i^max}) 

f-^max 

maximum degree among nodes 

Ins{x., d) 

insurance payout to an insured node from pop. d 

K 

maximum hop distance an infection can propagate 

Lp 

expected loss from an attack for a protected node 

Lu 

expected loss from an attack for a unprotected node 

AL 

Lu — Lp 

N(m,A',diA) 

a Nash equilibrium for given m, K and /3/^ 

cp 

cost of protection 

Cl 

insurance premium 

davg 

average or mean degree of nodes 

dNE 

degree threshold at a Nash equilibrium 

e(x) 

risk exposure at social state x 

fd or /d(m) 

fraction of pop. with degree d 

9d,a 

fraction of pop. d playing action a {gd,a = al'^d) 

m 

pop. size vector (m = (m^; d £ T))) 

m-d 

mass or size of pop. d 

Pp 

prob. of infection for protected nodes 

Ph 

prob. of infection for unprotected nodes 

Ap 

Ph - Pp 

Wd or ^^(m) 

weighted fraction of pop. with degree d 

X 

social state (x = (x^^; d £ T))) 

Xd 

pop. state of pop. d (x^ = (x^ a] c, £ .A)) 

^d,a 

size of pop. d playing action a 

y*(m, K,/3ja) 

a social optimum for given m, K and 

PlA 

prob. of indirect attack on a neighbor 

7(x) 

prob. that a node will experience an indirect attack 
from a neighbor when the neighbor is attacked 

TDA 

prob. that a node experiences a direct attack 

^cov 

fraction of insurance coverage over deductible 


TABLE I 

Notation (pop. = population, prob. = probability). 


A. Population game 

We assume that the maximum degree among all nodes 
is Umax < OO. Eof each d G {1,2,..., I^max} =: 'D, 
population d consists of all nodes with common degree 
We denote the mass or size of population d by rrid, and 
m := (rrid; d € 2?) is the population size vector that tells 

^ Since population d, d £ T), comprises all nodes with degree d, we also 
refer to d as the degree of population d hereafter. In addition, we implicitly 
assume that there is no isolated node with d = 0; since isolated nodes do not 
interact with any other nodes, they are of little interest to us. 
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US the sizes of populations with different degrees. Note that 
rrid does not necessarily represent the number of agents in 
population d\ instead, an implicit modeling assumption is that 
each population consists of so many agents that a population 
d G T) can be approximated as a continuum of mass or size 
rud G (0,oo)j^ 

All players have the same action space A := P} 

consisting of three actions - Insurance (/), No Action {N), and 
Protection (P)|^ Investment in protection effectively reduces 
potential damages or losses, hence, the risk for the player. 
In contrast, as mentioned before, insurance simply shifts 
the risk from the insured to the insurer, without affecting 
the overall societal cost ll28l . For this reason, we focus on 
understanding how underlying network properties and other 
system parameters govern the choices of players to protect 
themselves as a function of their degrees and ensuing social 
costs. 

i. Population states and social state - We denote by 

Xd = {xd,a, a G A), where ^d,,a = rrid, the population 

state of population d. The elements Xd,a, a G A, represent 
the mass or size of population d which employs action a. 
Define x := fx^; d G P) to be the social state. Let 
Xd ■■= {xd G R+ I Xd,a = md}, where R+ := [0, oo), 

and A’ := JldGC ^d- 

ii. Costs - The cost function of the game is denoted by 
C : -T —>^ ]|^3U„ax Pqj. admissible social state x G <T, 
the cost of a player from population d playing action a G A 
is equal to Cd,a(x). In addition to the cost of investing in 
protection or purchasing insurance, the costs depend on (i) 
expected losses from attacks and (ii) insurance coverage when 
a player is insured. 

In order to explore how network effects and system pa¬ 
rameters determine the preferences of players, we model two 
different types of attacks players experience - direct and 
indirect. While the first type of attacks are not dependent on 
the network, the latter depends critically on the underlying 
network and system parameters, thereby allowing us to capture 
the desired network effects on players’ choices. 

a) Direct attacks: We assume that malicious attacker(s) 
launch an attack on each node with probability tda, indepen¬ 
dently of other players]^ We call this a direct attack. When a 
player experiences a direct attack, its (expected) cost depends 
on whether or not it is protected', if the player is protected, its 
cost is given by Lp. Otherwise, its cost is equal to Lu{> Lp). 

These costs can be interpreted in many different ways. We 
take the following interpretation in this paper. Assume that 
each attack leads to a successful infection with some proba¬ 
bility that depends on the action chosen by the player. When 
the player plays P, an attack is successful with probability pf, 

'^The degree-based model we adopt in the study is often known as the 
Chung-Lu model 0 or the configuration model 

^There are other studies where the investment in security is restricted 
to a binary case, e.g., |4), 1211 . 1271 . In addition, while various insurance 
contracts may be available on the market in practice, as mentioned earlier, 
since insurance does not affect the preferences of other players, we believe that 
the qualitative nature of our findings will hold even when different insurance 
contracts are offered. 

^Our model can be altered to capture the intensity or frequencies of attacks 
instead, with appropriate changes to cost functions of the players. 


in which case the cost to the player is given by some rv Cp. 
Otherwise, the probability of successful infection is p\j and 
the player’s cost is given by rv Cp, whose distribution may 
be different from that of Cp. Then, the expected cost due to an 
infection when attacked is equal to pp • IE [Cp] when a player 
is protected and p\j ■ IE [Cp] otherwise. One can view these 
expected costs pp • IE [Cp] and pf ■ IE [Cp] as Lp and Lp, 
respectively, in our model. Throughout the paper, we assume 
0 < Pp < Pp < 1 and denote the difference Lp — Lp by 
AL > 0. 

b) Indirect attacks: Besides the direct attacks by malicious 
attackers, a player may also experience indirect attacks from 
its neighbors that are victims of successful attacks and are 
infected. In order to control the manner in which infections 
spread in the network via indirect attacks, we introduce two 
parameters. First, we assume that an infected node will launch 
an indirect attack on each of its neighbors with probability 
Pi A G (0,1] independently of each other. We call Pja 
indirect attack probability (lAP). Second, an infection due 
to a successful direct attack can propagate only up to AT G 
IN := {1,2,3,...} hops from its victim^ The lAP Pja 
primarily affects the local spreading behavior, whereas the 
parameter K influences how quickly an infection can spread 
before appropriate countermeasures are taken, e.g., a release 
of patches or vaccines. Clearly, as K increases, the infection 
can potentially spread to a larger portion of the network. 

In our model, we assume that the lAP is the same whether 
the infected node is protected or not, which is reasonable in 
some cases, e.g., spread of computer viruses or worms. But, 
in some other scenarios, this assumption may not hold. For 
instance, in a disease epidemic scenario, e.g., flu, those who 
are vaccinated are not only less likely to contract the disease, 
but also more likely to recover faster than those who are not 
vaccinated, thereby reducing the odds of transmitting it to 
others around them even if they become infected. 

Based on the above assumptions, we proceed to derive the 
cost function C for our population game. Let us denote the 
mapping that yields the degree distribution of populations by 
f : R^"“ —7^ [0,1]^““, where 

/d(m) = „ -, m G R:P"“ and d GV, 

Z-^d'eT) '^d' 

is the fraction of total population with degree d. Similarly, 
define w : R^'"^ —[0, where 

Wd(m) = =— ^ -, m G R:?"“ and dGV. (1) 

Ed'GC ^ ■ ^d' 

It is clear from the above definition that w gives us the 
weighted degree distribution of populations, where the weights 
are the degrees. 

Clearly, both f and w are scale invariant. In other words, 
f(m) = f((^-m) and w(m) = w((^-m) for all </) > 0. When 
there is no confusion, we write f and w in place of f (m) and 
w(m), respectively. 

We explain the role of the mapping w briefly. Suppose 
that we fix a social state x G A” and choose a player. The 

^This parameter K can instead be viewed as an average hop distance 
infections spread with appropriate changes to the cost function. 
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probability that a randomly picked neighbor of the chosen 
player belongs to population d G T> is approximately Wd 
because it is proportional to the degree d il, Hence, 

the probability that the neighbor has degree d and plays 
action a € ,4 is roughly Wd ■ Xd^a/rud- We will use these 
approximations throughout the paper. 

Let rfc(x), A: G IN, denote the expected number of indirect 
attacks a node, say i, experiences through a single neighbor, 
say j, due to successful direct attacks on nodes that are k 
hops away from node i. Based on the above observation, we 
approximate rfc(x) as follows under the assumption that the 
iL-hop neighborhood of a node can be approximated using a 
tree-like structurej^For notational ease, we denote the fraction 
of population d G T) that adopts action a G A (i.e., Xd,a/tnd) 
by gd,a and the fraction of unprotected population d G T) (i.e., 
(xd,N + Xd,i)/md = gd.N + gd.i) by gd,u hereafter. 

First, for fc = 1, 

ri(x) = • 7 (x), (2) 


where 


7 (x) = ^ Wd {gd,p Pp + gd,u Pu) ) 

VdG-D / 


= Pi A Ph - 


Ap 


J^d'p-D 


J-avg A^d'eT) 


- ^ d • Xd,p I , (3) 


d^V 


Ap := p\j - p^p > 0, and davg := J2dGV d ■ fd is the 
average or mean degree of the populations. Note that, from 
the above assumption, Y.de'D ' 9d,p (resp. Y.de'O • gd,u) 
is the probability that a randomly chosen neighbor is protected 
(resp. unprotected). By its dehnition, 7 (x) is the probability 
that a node will see an indirect attack from a (randomly 
selected) neighbor in the event that the neighbor experiences 
an attack hrst. Similar models have been used extensively in 
the literature (e.g., Il44ll . Il45ll '). Thus, if the degree of node 
i is di G T>, the expected number of indirect attacks node 
i suffers as a one-hop neighbor of the victims of successful 
direct attacks can be approximated using di • ri(x). 

Other Tk{xi),k G {2,...,K}, can be computed in an 
analogous fashion. Suppose that the neighbor j of node i 
has degree dj G T>. Then, by similar reasoning, the expected 
number of indirect attacks node j suffers as an immediate 
neighbor of the victims of successful direct attacks other than 
node i is {dj — l)ri(x). Hence, the expected number of 
indirect attacks node i sees as a two-hop neighbor of the 
victims of successful direct attacks through a single neighbor 


more cai'eful analysis of the degree distribution of a randomly selected 
neighbor is earned out in (m, which suggests that it is somewhat different 
from what we use here as an approximation. However, for large networks 
without isolated nodes, this discrepancy in distributions should be small. 

^As stated in Section |l| th is assumption may not hold in some of real-world 
networks as reported in (36), (m But, we make this assumption to facilitate 
our analysis. The same assumption is introduced in 1161 . (44), 1451 as well. 


is given by 

Pi A I Wd {gd,p Pp + gd,u Pu) X (d - l)ri(x) 

\dC:V 

= ri(x) • Wdid - 1) {gd,p Pp + gd,u p\j) 

\d&V 

Following a similar argument and making use of assumed tree¬ 
like iT-hop neighborhood structure, we have the following 
recursive equation for fc G {2,3,..., iT}: 



rfc(x) 


= rfc_i(x) ■ PiaI^ Wd{d - 1) ( 5 d,p Pp + gd,u Pu) ) 
Vde-D / 


= rfc_i(x) A(x) = ri(x) A(x) 


fc-1 


(4) 


where 


A(x) := Pi A ( Wd{d - 1) {gd,p Pp + gd,u Pu) ) 

\de-D / 

= PiaIYI (Pu - 9d,pAp) I . 

VdG-D / 


Dehne 


e(x) = — y]]rfc(x) = 7 (x)y]] A(x)*^ 1 

= / 7(x) if A(x) ^ 1, 

1 K ■ 7 (x) if A(x) = 1. 


K 


K 


(5) 


( 6 ) 


We call e(x) the (risk) exposure from a neighbor at social state 
X. It captures the expected total number of indirect attacks a 
player experiences through a single (randomly chosen) neigh¬ 
bor given that all nodes suffer a direct attack with probability 
one (i.e., tda = !)■ 

We point out two observations regarding the risk exposure. 
Recall that gd^p = Xd^p/rrid, d G T), denotes the fraction of 
population d which is protected. First, from its dehnition in (j^ 
and eqs. the exposure is determined by {xd,p', d G 

V) or, equivalently, {gd,p', d G T)), without having to know 
{xdj', d gV) or {xd,N\ d G V); each summand in (|^ can be 
computed from 7 (x) and A(x), both of which are determined 
by {xd p] d G V) or {gd p; d G V) according to (|^ and 
0. Second, the risk exposure is strictly decreasing in each 
Xd,p, d G 22; due to the minus sign in front of Xd,p in 0 
and gd^p in 0, 7 (x) (resp. A(x)) is strictly decreasing (resp. 
nonincreasing) in Xd,p, d G T). 

We assume that the costs of a player due to multiple 
successful attacks are additive and that the players are risk 
neutral0] Hence, the expected cost of a player from indirect 
attacks is proportional to e(x) and its degree. Based on this 
observation, we adopt the following cost function for our 


*®While we assume that the players are risk neutral to simplify the proofs 
of our analytical findings in Section |IV| risk aversion can be modeled by 
altering the cost function and similar qualitative findings can be reached at 
the expense of more cumbersome proofs; when they are risk averse, we expect 
the percentage of population investing in protection or purchasing insurance 
to increase, the extent of which will depend on the level of risk aversion. 
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population game: For any given social state x € A', the cost 
of a player with degree d G V playing a G A is given by 

Cd,a(x) 

T£)a (1 + • e(x)) Lp + cp if a = P, 

tda + d ■ e{x)) Lu if a = Nil) 

tda (1 + (i • e(x)) Lu + c/ — Ins{:x., d) if a = J, 

where cp and c/ denote the cost of protection and insurance 

premium, respectively, and Ins : X x V —i' H is a mapping 
that determines (expected) insurance payout as a function of 
social state and degree. Note that tda {1 + d ■ e(x)) is the 
expected number of attacks seen by a node with degree d, 
including both direct and indirect attacks. 

We assume that the insurance payout for an insured player 
of degree d G V is given by 

/ns(x,d) = min (Coumax, Ccov(Cd,Ar(x) - (ied)+), 

X G A’, (8) 

where Cov^nax is the maximum loss/damage covered by the 
insurance policy, ded is the deductible amount, G (0) 1] is 
the coverage level, i.e., the fraction of total damage over the 
deductible amount covered by the insurance (up to CoVmax), 
and (z)^ denotes max(0, x). Recall that Cd Ar(x) is the cost 
a node of degree d sees from attacks when unprotected. As 
one might expect, the difference in costs between actions N 
and / is equal to the insurance premium minus the insurance 
payout, i.e., cj — Ins{x, d). Moreover, it is clear from (j^ - ([^ 
that the cost of a player depends on both its own security level 
(i.e., protection vs. no protection) and those of other players 
through the exposure e(x). 

B. Solution concept - Nash equilibria 

We employ a popular solution concept for our study, namely 
Nash equilibria. A social state x* is an NE if it satisfies the 
condition that, for a\\ d GT) and a G A, 

2^5 a > 0 implies ^(x*) = min Cd,a'(x*). (9) 

’ a'^A 


Assumption 1: We assume that the population size vectors 
are normalized so that the total population size is one. 

Note that Assumption [T] implies that the population size 
vector m and its degree distribution f(m) are identical. Hence, 
a population size vector also serves as the degree distribution. 

C. Cascades of infection 

Our model described in the previous subsections aims to 
capture the interaction between strategic players in IDS scenar¬ 
ios under the assumption that infections typically do not spread 
more than K hops. However, some malwares may disseminate 
unnoticed (for example, using so-called zero-day exploits HI) 
or benefit from slow responses by software developers. When 
they are allowed to proliferate unhindered for an extended 
period, they may reach a greater portion of the network than 
typical infections or malwares can. In this subsection, we 
investigate whether or not such malwares can spread to a large 
number of nodes in the network by determining when cascades 
of infection are possible. 

In order to simplify the analysis, we follow an approach 
similar to the one employed in ll44l . Rather than analyzing a 
large finite network, we consider an infinite network in which 
the degree of each node is d with probability /c;(m) = mii, 
d G T>, independently of each other. By the strong law of large 
numbers, the fraction of nodes with degree d converges to 
almost surely for all d G T>. The elements Xd,a, d G V and 
a G A, of the social state x can now be interpreted as the 
fraction of nodes that have degree d and play action a. Using 
this model, we look for a condition under which the probability 
that the number of infected nodes diverges is strictly positive. 
We call this the cascade condition. 

Fix social state x G A”. When there is no confusion, 
we omit the dependence on the social state x for notational 
convenience. Suppose that we randomly choose a node, say 

i, and then randomly select one of its neighbors, say node 

j. As argued in Section |III-A[ the probability that node j is 
vulnerable, i.e., it will be infected if attacked, is given by 


The existence of an NE in a population game is always 
guaranteed Theorem 2.1.1, p. 24]. 

We discuss an important observation that facilitates our 
study. From ([^ - ([^, the cost function also has a scale 
invariance property, i.e., C(x) = C(^ • x) for all </> > 0. 
This offers a scalable model that permits us to examine the 
effects of various system parameters (e.g., degree distribution 
of nodes, parameter K and lAP /3 /a) on NEs without suffering 
from the curse of dimensionality even when the population 
sizes are very large: Suppose that NS* denotes the set of 
NEs for a given population size vector m^. Then, the set of 
NEs for another population size vector f for some 

(/) > 0 is given by {(/> • x | x G NS*}. This in turn means that 
the set of NEs scaled by the inverse of the total population size 
is the same for all population size vectors with the identical 
degree distribution. For this reason, it suffices to study the 
NEs for population size vectors whose sum is equal to one, 
'ThdSi'D = 1- We will make use of this observation in 
our analysis in Sections IV and |V] 


Wd {gd.p ■ Pp + (1 - 5d.p) ph) = 'i{^)/I3ia- 

d^V 

Suppose that we initially infect node i, and let the infection 
work its way through the network via indirect attacks (with 
no constraint on K). We call the resulting set of all infected 
nodes the infected cluster. When the size of infected cluster 
is infinite, we say that a cascade of infection took place. 

In our model, the nodes are strategic players and can change 
their actions in response to those of other nodes. Therefore, 
how widely an infection can disseminate starting with a single 
infected node, depends on the actions taken by the nodes at 
social state x, which are interdependent via their objectives. 
We are interested in exploring how (a) the probability of 
cascade at NEs and (b) the POA/POS vary as we change (i) 
the node degree distribution, (ii) parameter K and (iii) lAP 
Pi A- This study can be carried out under assumptions similar 
to those in ll22]l . Il44ll . ||45]| as explained below. 

Following analogous steps as in IHl, we assume that the 
infected cluster has a tree-like structure with no cycle. As 
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argued in l44l . this is a reasonable approximation when the 
cluster is sparsely connected. 



Fig. 1. Infected subcluster containing node j and its size Cj. 


Denote the set of node i’s neighbors by Mi- For each j S Ni, 
let Cj be the size of the infected subcluster including node j 
after removing the remaining cluster connected to node j by 
the edge between nodes i and j. An example is shown in 
Fig. 0 In the hgure, the infected subcluster containing node 
j lies inside the dotted red curve. In this example, Cj = 3. 
When neighbor j is not infected, we set Cj = 0. It is clear 
that a cascade of infection or contagion happens if and only 
if Cj = oo for some j G Afi- 

When a neighbor j is infected, the number of fc-hop neigh¬ 
bors of node j in the aforementioned infected subcluster can 
be viewed as the size of fc-th generation in Gabon-Watson (G- 
W) model IHl, El, starting with a single individual: Suppose 
that node j is infected by node i and that node £ is a A:-hop 
neighbor of node j in the infected subcluster that includes node 
j, for some k G S_|_. When k = 0, node £ is node j itself. 
Let N denote the number of node £’s infected neighbors that 
are k + 1 hops away from node j in the same subcluster and 
contract the infection from node £. In the example of Fig. 
node £ is one-hop away from node j and the rv N = 1. 

From its construction, the distribution of N does not depend 
on k, and its probability mass function (PMF) q^r : R —[0,1] 
is given by 


qjv(n) 


E 


dG { n+1 ,..., Z)rriax } 


<”r^)7(x)”(l-7(x)) 


d-l-r 


if n G {0,1,...,1} J 
0 otherwise, 


where 7 (x) is the aforementioned probability that the infection 
of a node is transmitted to a neighbor, and w™ = (w™; d G 
V) with 


= 


Wd{gd,p Pp+gd.u p\j) 
Ed'G-D Wd'{gd',p Pp + gd',u P\j) 
jdiA ■ wd{gd,p Pp + gd,u Pu) 


( 10 ) 


7(x) 


dGV. 


Note that, by dehnition, lu™, d G V, is the probability that 
a neighboring node has degree d conditional on it being a 


victim of a successful indirect attack; the numerator of ( fTO) ! is 
the probability that a neighbor has a degree d and is vulnerable 
to infection. 

The number of fc-hop neighbors in the infected subcluster 
containing node j, which we denote by Cj, k G fN, can now 
be studied using the G-W model. In Fig. Ill = 1 for 
kG {l,2}andC'^^ = 0 for fc > 3. Each individual representing 
an infected node produces n, n G (0,1,..., Umax — 1}. 
offsprings according to the PMF q^r. Consequently, the prob¬ 
ability P [Cj < oo] is given by the smallest nonnegative root 
of the equation Qn{s) = s ifTTl p. 173], where 

Qn{s) = E qAr(n) s", s € R for which the sum 


This solution, denoted by s*(x), always lies in [0, 1]. More¬ 
over, s*(x) = 1 if (i) IE [W] < 1 or (ii) IE [TV] = 1 and 
(ZAr(l) 1. When IE [TV] > 1, we have s*(x) < 1. 

By conditioning on the degree of the initial infected node, 
namely node i, we obtain 

P [cascade takes place at social state x] 

= f-^fd{f-l(pi){f-s*{-x))Y. ( 11 ) 

de-D 

Therefore, assuming 7 (x) > 0, IE [TV] > 1 is a sufficient 
condition for the cascade probability to be strictly positive. 
In addition, except for in uninteresting degenerate cases, 
IE [TV] > 1 is also a necessary condition. We mention that 
the task of determining whether a cascade is possible or not 
can be carried out without explicitly computing the PMF qjv 
by noting that IE [TV] is also equal to EdGC ~ l)7(x)- 
Before we proceed, we summarize questions we are inter¬ 
ested in exploring with help of the population game model 
described in this section: 

Q1 Is there a unique NE? If not, what is the structure of 
NEs? 

Q2 What is the relation between the degree of a node and its 
equilibrium action? How do the parameters K and Pia, 
which govern the propagation of infections, influence the 
choices of different populations at NEs? 

Q3 What is the POA/POS? How do the network properties 
and system parameters affect the POA/POS? 

Q4 How do network properties, in particular the node degree 
distribution and average degree, and system parameters 
shape the resultant probability of cascade at NEs? 

IV. Main analytical results 

This section aims at providing partial answers to questions 
Q1 through Q3 based on analytical findings. Before we state 
our main results, we first state the assumption we impose 
throughout this and following sections. 

Assumption 2: The following inequalities hold. 

a. Lp < (1 - ^cov) Lp-, and 

b. cp > Cl + ded. 

Assumption |^a states that when a player is attacked, its 
expected cost is smaller when it is protected than when it 
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is insured. This implies that the coverage level is less than 
100 percent even when insured. We note that, in addition 
to deductibles, coinsurance (i.e., ^cov < 1) is often used to 
mitigate the issue of moral hazard by sharing risk between 
both the insurer and the insured]^ Shetty et al. showed that, 
in the presence of informational asymmetry, only a portion 
of damages would be covered by insurance at an equilibrium 
ll39l . Assumption [^b indicates that the investment a player 
needs to make in order to protect itself against possible attacks 
is larger than the insurance premium plus the deductible 
amount. We believe that these are reasonable assumptions in 
many cases. 

We hrst examine the structure of NEs of the population 
games and the effects of parameters K and Pi a on NEs in 
Section IV-A Then, we investigate the social optimum and 
(an upper bound on) the POA/POS as a function of system 
parameters in Sections IV-B and IV-C respectively. 


A. Population games 

Theorem 1: Let m € be a population size vector 

and X* G A be a corresponding NE for some AT G IN and 
Pi A e (0, l].Ifa:^^_p > 0 for some di G {1, 2,..., R^ax-l}, 
then a;J p = rrid for all d > di. 

The proof of Theorem [T] is similar to that of Theorem 1 in 
m and is omitted. 

We note that Theorem [T] also implies the following: If 
^d 2 ,P < '^d 2 for some ^2 G {2,..., Rmax}, then x*^ p = 0 
for all d < d-i- 

In practice, the exposure of a node to indirect attacks will 
depend on many factors, including not only its own degree, 
but also the degrees and protection levels of its neighbors. 
Therefore, even the nodes with the same degree may behave 
differently. However, one would expect that the nodes with 
larger degrees will likely see higher exposures to indirect 
attacks and, as a result, have a stronger incentive to invest 
in protecting themselves against (indirect) attacks. Theorem [T] 
captures this intuition. 

The following theorem suggests that, although an NE may 
not be unique, the size of each population d G T) investing 
in protection is identical at all NEs. Its proof follows from a 
straightforward modification of that of Theorem 2 in ll22ll . and 
is omitted. 

Theorem 2: Suppose that and x^ are two NEs of the 

same population game. Then, p = p for all d GT). 

The uniqueness of the sizes of protected populations at NEs 
shown in Theorem is crucial for our study. It implies that 
the cascade probability, which we adopt as a (global) measure 
of network security, is identical at all NEs even when there is 
more than one NE. Eor this reason, it enables us to examine 
and compare the network security measured using cascade 
probabilities, as we vary the node degree distribution and 
parameters K and Pia- 

* * Another way to deal with the issue of moral hazard is premium discrim¬ 
ination that ties the insurance premium directly with the security measures 
adopted hy a player as suggested in a, ED 


Let us explain briefly why an NE is not necessarily unique. 
Suppose that the expected cost of playing I and N is the same 
and is smaller than that of playing P for some population d 
at an NE. Then, there are uncountably many NEs. This is 
a consequence of an earlier observation that a purchase of 
insurance by a player does not affect the costs of other players, 
hence their (optimal) responses. 

Because the populations choosing to protect remain the 
same at all NEs (when more than one NE exist) and the 
issues of interest to us depend only on populations invest¬ 
ing in protection, with a little abuse of notation, we use 
N(m, A:,/3 /a) = (Nd,a(m, d G T> and a G A) to 

denote any arbitrary NE corresponding to a population size 
vector m, AT G IN and Pja G (0,1], where ^(m, K,Pia) 
is the size of population d playing action a at the NE. 

Theorems and Instate that, for fixed population size vector 
m and parameters AT and Pi a, there exists a degree threshold 
given by 

d^^{m,K,PiA) = min{d G V \ Nd,p(m, AT,/3 /a) > 0} 


such that only the populations with degree greater than or 
equal to the threshold would invest in protection at any NE. 
When the set on the right-hand side (RHS) is empty, we set 
d^^{m, K, Pia) = Rmax + 1- The existence of a degree 
threshold also greatly simplifies the computation of NEs, 
which are not always easy to compute in general. 

The following theorem sheds some light on how the degree 
threshold d^^{m, K, Pia) behaves with varying K or Pia- 

Theorem 3: Suppose Ki,K 2 G IN with AT/ < K 2 . Then, 
for any population size vector m and lAP /3/a G (0,1], we 
have 


y] Nd,p(ni, Ki,Pia) < Nd,p(ni, K2 ,Pia)- 

d^T> d^T> 

Similarly, for any population size vector m and K G IN, 

y2 Nd,p(m,iT,/3)A) < y] Nrf,p(m,iT,/3fA) 

d^'jy d^'D 


if 0 < /3)^ < /3|^ < 1. 

Proof: A proof is given in Appendix ■ 

Theorem is quite intuitive; as K or /3/a increases, the 
effect of a successful direct attack is felt by a larger portion 
of the populations. Consequently, for any fixed social state x, 
the exposure e(x) grows with K and Pia- As a result, some 
of population that would not invest in protection with smaller 
AT or Pia will see greater benefits of protecting themselves 
because the cost of action N or I increases faster than that 
of P by Assumption Consequently, a larger fraction of 
population chooses protection. However, as we will show in 
Section V-B these two parameters have very different effects 
on the resulting cascade probability. 


B. Social optimum 

In this subsection, we consider a scenario where there is 
a single social player (SP) that makes the decisions for all 
populations. The goal of the SP is to minimize the overall 
social cost given as the sum of (i) damages/losses from attacks 
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and (ii) the cost of protection. In other words, the social cost 
at social state x G A’ is given by 


S'C'(x) 

=i:[( 

=i:( 

d^V 


Xd,a ■ Cd,a(x)j + Xdj{lns{yL,d) - c/) (12) 

a^A 

Xd,p ■ (x) + {md — Xd,p)Cd,N{^)^ ■ (13) 


Note that J2dev {Ixis{x, d) — ci) in (fT^ is the (net) cost 
for insurer(s). Hence, the social cost givenby (121 accounts 


for the costs of all players, including the insurer(s). 

Moreover, it is clear from ( [T3] l that the social cost depends 
only on Xd,p^ d G T), as insurance simply shifts some of the 
risk from the insured to the insurer as pointed out earlier. For 
this reason, we can limit the possible atomic actions of SP 
to {P,N} and simplify the admissible action space of SP to 
y ■= ndex>[0i"*d]- A” SP action y = {yd; d G V) G y 
specihes the size of each population d that should invest in 
protection (i.e., yd) with an understanding that the remaining 
population md — yd plays N. 

Let us dehne a mapping X : A”, where 


Xd,a(y) = 


yd if a = P, 

rud-yd if a = N, 

0 if a = /. 


Fix an SP action y G 3^. The social cost associated with y is 
given by a mapping S'C' : (V —> R, where 

^(y) = SC{X{y)) 

= 'E{yd- Cd.p(X(y)) + (rrid - 2/d)Cd.iv(X(y))) . (14) 

dGV 

The goal of SP is then to solve the following constrained 
optimization problem. 

SP-OPT: 


min SC{y) (15) 

yey 

Let y* G argminyg^; S'C(y) denote any minimizer of the 
social cost. When we wish to make the dependence of y* on 
the population size vector m, parameter K or lAP Pja clear, 
we shall use y*(m, iT,/S/^). 

The following theorem reveals that, like NEs, any minimizer 
y* has a degree threshold so that only the populations with 
degree greater than or equal to the degree threshold should 
protect at the social optimum. 

Let d^ = min{d G 22 | > 0}. As before, if the set on 

the RHS is empty, we set rfl = I2max + 1- 

Theorem 4: If cJl < Dmax, Vd = for all d > d^. 

Proof: A proof is provided in Appendix ■ 

We can prove the uniqueness of the minimizer y* by making 
use of Theorem |4l 

Theorem 5: There exists a unique solution y*(m, K,Pia) 
to the SP-OPT problem. 

Proof: Please see Appendix for a proof. ■ 

While the statements of Theorems |4] and |5] are similar to 
those of Theorems 4 and 5 in ll22l . the proofs in ll22ll do not 
apply to the settings in this paper. 


The following theorem tells us that the protected population 
size is never smaller at the social optimum than at an NE. Its 
proof is similar to that of Theorem 7 in ll22l and is omitted. 

Theorem 6: Eix a population size vector m, Ff G IN 
and PiA G (0,1]. Let x* = N(m, AT,/3/^) and y* = 
y*(m, K, Pia). Then, Y^dav < Ydev Vd- 

Theorem tells us that the damagesAosses due to attacks 
are higher at NEs than at the system optimum. Hence, because 
the system optimum is unique, the savings from smaller invest¬ 
ments in protection at NEs (compared to system optimum) are 
outweighed by the increases in damages. Thus, the network 
security degrades as a result of selhsh nature of the players 
as suggested in Ei, Ezl. This naturally leads to our next 
question: How efficient are NEs in comparison to the social 
optimum? 


C. Price of anarchy 

Inefficiency of NEs is well documented, e.g., JH, HU, 
ini Chap. 17-21], l34l . In particular, the Prisoner’s Dilemma 
illustrates this clearly ll33l . However, in some cases, the 
inefficiency of NEs can be bounded by hnite POA/POS ll20l . 

Recall that because all NEs achieve the same social cost in 
the population games we consider by virtue of Theorem]^ the 
POA and POS are identical. We are interested in investigating 
the relation between system parameters, including degree 
distribution f, K and fdjA, and the POA. 

Theorem 7: Let m be a population size vector and davg be 
the average degree of the populations. Suppose cp > AL-toa- 
Then, for any AT G IN and /3 ia G (0,1], 


SC(N(m,K,/3jA)) 

^(y*(m,K,/3jA)) 


^ 1 -|- ^iavg ‘ ^max {m,K,^iA), (16) 


where 


K-l 


emax(m, AT, Pia) = Pi a Pu ^ d{d - l)md 


k=0 


J-avg 


dev 


is the largest possible exposure nodes can see when no 
population invests in protection, i.e., Xd^p = 0 for all d G 22. 

Proof: A proof is given in Appendix ■ 

The assumption cp > AL-tpa in the theorem is reasonable 
because it merely requires that the insurance premium is at 
least the difference in the expected losses sustained only from 
a direct attack, not including any additional expected losses 
a player may incur from indirect attacks. Since a private 
insurer will likely charge a premium high enough to recoup 
the average insurance payout for insured players, the premium 
will need to be higher than ^cov{xDA{^+d^f^g-e{xj)Lu — ded), 
where d™® is the average degree of insured players. Therefore, 
assuming that ^cov is not too small and/or the deductible is not 
too large, the premium is likely to be at least AL ■ toa- 
The upper bound on POA in Theorem |7] is tight in the 
sense that there are examples where the POA is equal to the 


bound. We will provide a numerical example in Section V-C 
for which the POA is close to our bound in the theorem. 
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V. Numerical results 

In this section, we use numerical examples to i) verify our 
findings in Theorems [T] and and ii) illustrate how cascade 
probability is shaped by system parameters. For the hrst three 
examples in Sections |V-A| through |V-C[ we use a family of 
(truncated) power law degree distributions given by | m“; a € 
[0,3]}, where oc d~°‘, d GV. Over the years, it has been 
suggested that many of both natural and engineered networks 
have a power law degree distribution (e.g., Cl, M)- Using 
Lemma 3 in Appendix D of one can easily show that 
the degree distribution f(m“) becomes smaller in the usual 
stochastic order 1371 with increasing a. This implies that the 
average degree decreases with a, which ranges from 1.33 (for 
a = 3) to 10.5 (for a = 0) with I?niax = 20. For the last 


example in Section V-D we adopt a family of (truncated) 
Poisson degree distributions parameterized by A S [1.1,10.6]. 

Also, we would like to mention that, although we assume 
Pp = 0 and pp = 1 for our numerical examples presented 
here, similar qualitative results hold when other values satis¬ 
fying pp < pp are used. 


A. Cascade probability, degree threshold, and protected pop¬ 
ulation size 

The parameter values used in the hrst example are provided 
in Table M 


Parameter 

Value 

Parameter 

Value 

Parameter 

Value 

tda 

0.95 

Ph 

I.O 

Pp 

0 

^cov 

0.8 

ded 

20 

CoV-mayi 

500 

Lp 

10 

Lu 

100 

diA 

0.85 

cp 

300 

Cl 

40 

-^max 

20 


TABLE II 

Parameter values for first numerical example. 



Eig. 2. Plot of (a) degree threshold iC,/3j^), (h) fraction of 

protected populations, (c) probability of cascade, and (d) IE [N]. 


Fig. I^plots (a) degree threshold K, Pi a), (b) the 

fraction of total population that invests in protection at NEs, (c) 


cascade probability given by (111, and (d) IE [A^] (discussed in 
Section III-C| l as a function of the parameter K and the power 
law parameter a. It is clear from Fig. |^a) that, with other 
parameters hxed, the degree threshold , K, Pia) is 

nonincreasing in K. This leads to a larger fraction of total 
population investing in protection (Fig. [^b)) with increasing 
K as proved in Theorem [^ In addition. Fig. |^c) shows 
diminishing cascade probability with increasing K. 

Fig. I^b) also suggests that the fraction of protected popula¬ 
tion in general goes up with an increasing average degree (or, 
equivalently, decreases with the power law parameter a). From 
this observation, one might expect the cascade probability 
to diminish with the average degree. Surprisingly, Fig. |^c) 
indicates that the cascade probability climbs with an increasing 
average degree at the same time. 

We suspect that this somewhat counterintuitive observation 
is a consequence of what we see in Fig. |^a): Over the 
parameter settings where the cascade probability is nonzero, 
the degree threshold d^^{nC, K, Pia) generally rises with 
the average degree. This suggests that, even though more 
of the population invests in protection, because nodes with 
increasing degrees, but smaller than the degree thresholds 
are still unprotected and vulnerable, it becomes easier for an 
infection to propagate throughout the network with the help 
of such vulnerable nodes with increasing degrees. 


B. Effects of indirect attack probability Pi a 

In the second example, we vary lAP Pi a while keeping the 
values of other parameters the same as in the hrst example. 
Our aim is to investigate how the lAP inhuences the cascade 
probability and the fraction of protected population and com¬ 
pare it to the effects of parameter K. 

Fig. [^ shows the cascade probability and the fraction of 
population investing in protection as lAP Pi a and parameter 
K are varied for three different values of a (a = 0.2, 1.2 and 
2 . 2 ). 

We point out three observations. First, as alluded to in 
the hrst example, the cascade probability decreases with a, 
as does the fraction of protected population. As mentioned 
in Section [I^ this observation is in sharp contrast with the 
hndings by Watts ll44l . Figs. [^ and [^ suggest that when 
the nodes are strategic and can choose to protect themselves 
to reduce the probability of infection, at least for certain 
parameter regimes, the network becomes less stable in that 
the cascade probability rises as the average degree increases 
(i.e., a decreases) and the second (phase) transition observed 
in ll44ll and described in Section [n| is missing. 

Second, it is clear from Fig. ^ that, although a larger 
fraction of population invests in protection with increasing Pia 
as proved in Theorem [^ the cascade probability also rises. 
What may be surprising at hrst sight is how differently the 
parameters K and Pia affect cascade probability in spite of 
the similarity in the way they inhuence the portion of protected 
populations as illustrated in Fig. [^ while raising K results in 
diminished cascade probability, increasing Pia leads to rising 
cascade probability. 

This can be explained as follows: Once other parameters 
and social state are hxed, cascade probability does not depend 
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alpha = 0.200000 


alpha = 0.200000 




alpha = 2.200000 



values of other parameters are listed in Table III For this 


Parameter 

Value 

Parameter 

Value 

Parameter 

Value 

tda 

0.9 

p\j 

1.0 

pp 

0 

^cov 

0.95 

ded 

5 

Ooilrnax 

500 

Lp 

5 

Lu 

95 

PlA 

0.1 

cp 

88 

Cl 

80 

-f^max 

20 


TABLE III 

Parameter values for first numerical example. 


in Theorem]^ We change the x-axis to average degree so that 
it is easier to see the effect of average degree on the realized 
POA and the bound. Recall that the average degree decreases 
with increasing a. 






— NE 

— OPT 



46 8 10 12 

average degree 



(a) 


(b) 


(c) 


Fig. 3. Plot of the cascade probability and the protected population size, (a) 
a. = 0.2, (b) a. = 1.2, and (c) a. = 2.2. 


on K. Hence, increasing the protected population size reduces 
cascade probability. On the other hand, with other parameters 
and social state hxed, cascade probability climbs with /3/a- 
Thus, although the fraction of protected population increases 
with /3 /a, because the nodes are strategic, they do not invest 
enough in protection to keep cascade probability from rising. 
This can be partially inferred from growing inefficiency of 
NEs as hinted by the upper bound on POA in Theorem [7] 

Third, Fig. indicates that the effect of lAP is more 
pronounced when the average degree is larger in the sense that 
cascade probability rises more quickly with the lAP (when it is 
small). This is intuitive; when the network is highly connected, 
it provides an infection with a greater number of paths through 
which the infection can spread. Hence, even when the lAP is 
relatively small, it will be able to propagate throughout the 
network more easily. 

C. Price of anarchy 

In the next example, we examine the POA as the average 
degree of nodes varies. We set AT = 5 for this example. The 


example, we purposely choose parameter values so that the 
POA is close to its upper bound. 

Fig. 1^ plots (a) degree threshold 5,0.1), (b) 

fraction of protected population, and (c) POA and its bound 


Fig. 4. Plot of (a) degree thresholds, (b) fraction of protected population, 
and (c) POA. 

First, it is obvious from Fig. j^c) that both the POA 
and the bound grow much faster than linearly. Hence, while 
a greater portion of populations elects to protect when a 
is smaller (hence, the average degree is larger) as shown 
in previous subsections, the cascade probability rises with 
an increasing average degree, and so does the POA. These 
hndings suggest that when the nodes are strategic entities 
interested only in minimizing their own costs, for keeping 
the cascade probability small, it is better to have less evenly 
distributed node degrees with fewer large-degree nodes. 

Second, Figs.Qb) andj^c) tell us the following interesting 
story. When a is small (i.e., the degree distribution is more 
even), although nodes with degrees less than hve, which ac¬ 
count for about 20-30 percent of total population, do not invest 
in protection at the system optimum, the POA closely tracks 
the bound and rises rapidly with the average degree. Therefore, 
there is an interesting trade-off one can observe; When the 
degree distribution is less evenly distribution, the network 
is held together by nodes with high degrees. Such networks 
are shown to be robust against random attacks, but are more 
vulnerable to coordinated attacks targeting high-degree nodes 
m, im. One possible way to mitigate the vulnerability is to 
increase the connectivity of the network, hence, the average 
degree. However, Fig. Qa) indicates that increasing network 
connectivity not only leads to higher cascade probability as 
illustrated in previous subsections, but also results in a higher 
social cost and greater POA, which is undesirable. 

D. Poisson degree distribution 

In the last example, we consider a family of (truncated) 
Poisson degree distribution A G [1.1,10.6]}, where 

cx A'^/d!, d GV. The remaining parameters are identical 
to those in Table |II| of Section IV-AI 
Fig. I shows (a) the degree threshold AT, /3/a) 

and (b) the fraction of protected populations as a function of 
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Fig. 5. Plot of (a) degree threshold d^^{icn^, K, I3 ia)^ (b) fraction of 
protected populations. 


network properties shape the decisions of strategic agents and 
resulting system security and social cost. We established the 
existence of a degree threshold at both Nash equilibria and 
social optima. Furthermore, we demonstrated the uniqueness 
of social cost at Nash equilibria, although there could be more 
than one Nash equilibrium. In addition, we derived an upper 
bound on the POA, which increases superlinearly with the 
average degree of nodes in general, and demonstrated that the 
bound is tight. Finally, our study suggests that as the average 
degree increases, despite a higher fraction of nodes investing 
in protection at Nash equilibria, cascade probability also rises. 


A and K. Clearly, the percentage of protected population tends 
to increase with the average degree (although there is no strict 
monotonicity), which is consistent with an earlier observation 
with power law degree distributions. In addition, the degree 
threshold Ff,/3 /a) tends to climb with the average 

degree. 



(a) (b) 

Fig. 6. Plot of cascade probability, (a) Poisson distributions, (b) power laws. 


In Fig. 1^ we plot the cascade probability for both (a) 
Poisson distributions and (b) power laws. There are two obser¬ 
vations we would like to point out. First, in the case of Poisson 
distributions, the cascade probability shows a cyclic behavior. 
While similar cyclic patterns exist with power law degree 
distributions as well, they are more pronounced with Poisson 
degree distributions. These cycles shown in Fig. |^a) coincide 
with the degree threshold K, in Fig. |^a); 

the dips in the cascade probability occur while the degree 
threshold remains constant. We suspect that these cycles are a 
side effect of a population game model that is a deterministic 
model. Nonetheless, the two plots show similar general trends 
and the cascade probability reveals an increasing trend with 
the average degree for both power law and Poisson degree 
distributions. 

Second, the cascade probability exhibits higher sensitivity 
with respect to the average degree, especially when the average 
degree is small, in case of Poisson distributions. In other 
words, as the average degree rises, the cascade probability 
increases more rapidly with Poisson distributions than with 
power laws. This suggests that, even for a fixed average degree, 
the cascade probability is likely to depend very much on the 
underlying degree distribution. 

VI. Conclusions 

We studied interdependent security with strategic agents. In 
particular, we examined how various system parameters and 
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Appendix A 
Proof of Theorem[3] 

We only prove the first part of the theorem as the second part 
follows from essentially an identical argument. Suppose that 
the theorem is false for some population size vector m, lAP 
/3 /a, and two distinct Ki and K 2 satisfying 1 < Ki < 3^2- 
We will show that this results in a contradiction. In order to 
make the dependence on the parameter K explicit, we denote 
the cost function C(x) and the exposure e(x) by C(x; AT) and 
e(x; K), respectively. Moreover, for notational simplicity, we 
denote N(m, ATi, /3/a), * = 1,2, by x® in this section. 

We first state a property that will be used shortly. 

Property PI: Suppose that x^ and x^ are two social states 
such that e(xi) < e(x^). Then, the following inequalities hold. 


which follow directly from the cost function given in (0 - ([^ 
and Assumption |^a: For all d G T>, 

0 < Cd,p(x2) - Crf,p(xi) < Cd,/(x2) - Cd./(xi) 

< Cd_jv(x^) — Cd_jv(x^). 

We point out that this property continues to hold even when 
we compare social states for two different population sizes 
and or for different values of parameter AT or /3/a, which 
satisfy the inequality in the exposures. 

Let di = min{(i G T) \ x); p > 0}, / = 1,2, with an 
understanding di = Umax + 1 if p = 0 for all d G V. 
Then, from the above assumption and Theorem we must 
have p < p. By the definition of an NE, 

Cdi,p(x^; ATi) < min{Cdj,/(x^; ATi), Cd^_Ar(x^; ATi)}. (17) 

From the assumption p < x\ p for all d G I? and 
p < x\^ p, we get e(x^;Ari) < e(x^;Ar 2 ). Therefore, 
property PI tells us 

Cdi,p(x^; K 2 ) — Cdj_p(x^; ATi) 

< min (Cdi,a(x^; A: 2 ) - Cdi.a(x^; ATi)). (18) 

aGfAf,/} 

Together with ( [T7] i, the inequality in ( [T^ yields 

Cdi.p(x^; Ar 2 ) < min{Cdi,Ar(x^; Ar 2 ), j(x^; 7^2)}. 

Obviously, this implies x^^ p = and, hence, contradicts 
the assumption x^^ p < x]^^ p < md^. 


Appendix B 
Proof of Theorem|4] 

We prove the theorem by contradiction. Assume that there 
exists d' > d) such that < md' ■ Suppose that e is a constant 
satisfying 0 < e < min{i/*,, uid' — y^} and is a zero- 
one vector whose only non-zero element is the d-th entry. 
Let yl = y* + e(u£i/ — We will show that S'C'(yl) < 
SC{y*), contradicting the assumption that y* is a minimizer 
of the social cost. For notational simplicity, we write x^ and 
X* in place of X(yl) and X(y*), respectively, throughout this 
section. 

After a little algebra, 

^(y*)-^(yl) 

= tda (e(x*) - e(xl)) ^ d {y^ Lp + {md - y*d)Lu) 

d^D 

+ e TDA{d' - dl)e(xl)AA. (19) 


It is clear that the second term in is strictly positive 
because d' > d\ e(x^) > 0 and AA > 0. Thus, to show that 
(191 is nonnegative, it suffices to prove e(x^) < e(x*). To 
this end, we demonstrate 7 (x^) < 7 (x*) and A(x^) < A(x*). 
From (j^, these inequalities imply e(x^) < e(x*). 

First, from ([^, 

7 (x*) - 7 (xt) = ^ (d' - d^) > 0. 


Second, from (j^, we get 

A(x*) - A(xt) = iJ^fL^{d'{d' - 1) - d\d^ - 1)) > 0. 

CZavg 
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Appendix C 
Proof of Theorem|5] 


Suppose that the theorem is not true and there exist two 
distinct minimizers and y^. By Theorem without loss 
of generality, we assume i) for all d G I? and ii) 

Vd ^ Vd d G T). We will show that this 

leads to a contradiction. Throughout this section, we denote 
X(y®), 1 = 1,2, by x* for notational simplicity. 

Let d* = min{(i G I? | > 0}, i = 1,2, with the 

convention d® = Umax + 1 if y* = 0. Note that < Umax 
by assumption. Since y^a > 0, with a little abuse of notation, 
the one-sided partial derivative of the social cost with respect 
to y ^2 at y^ satisfies 


d 

dyd^ 


SC(y^) ;= lim 


<5 


6 ■ Ud2) 


< 0 


with the equality holding when y^a < rnj^ 2 . Define another 
one-sided partial derivative of the social cost with respect to 
yd 2 at yi to be 


d 

dyd^ 


SC(y^) ;= lim 


^C(yi+<5-Urf2))-,gC(yi) 

S 


Since y^ minimizes the social cost, dSC{y^)/dyj 2 > 0. How¬ 
ever, we will show that dSC{y^)/dyj 2 < dSC^y"^)/dycp < 
0, leading to a contradiction. 

From ( [l4| i, 

J^SC{r) = Crf.,p(x*) - Cd2,^(x*) (20) 


Using the cost function in (j7]i, we obtain 

A-Cd,p(x ) = tda Lp d- - 

uyd^ oyd2 

9 , r J ^ 

A-j = TpA Lp a- - 

oyd^ uyd^ 


e(x*), and 
e(x*). 


Here, de{-xl)/dyd 2 and dCd,a['yd)/dy^?, a G {P, A^}, are 
appropriate one-sided partial derivatives. Substituting these in 


d 

dyd'^ 


SC{y") = cp- tda 


{1 + d^ e(x*)) AL 


( 21 ) 


+ tda d {fd Lp + {rud - yd)Lu) 

d^V 


d 

dyd^ 


e(x^). 


We rewrite dSC{y^)/dyd 2 in a more convenient form for 
our purpose. 


^^S'C'(y^) = cp- Tda (l + d^ e(x^)) AP 

+ ^TDAd {yd Lp + {rud - yl)Lu + {yl “ dD^L) 

d^V 


X 


d 

dyd^ 


e(xi) 


Using the above expression, 

= Tda d? AL(e(x^) - e(x^)) 

- X! '^da d {yj Lp + {rud - yj)Lu) 


( 22 ) 


dev 


0 /1\ / 2\ 
e(xi) - ^e(x^) 


dyd 


dyd'^ 


+{yd - yD^L 


d 

dyd'^ 


;(xi) 


Because y ' < where the inequality is element-wise, 
and y^a > y^ 2 , we have e(x^) < e(x^) and the first term in 
p2 1 is positive. Moreover, from the definition of the exposure 
in ( 61 , it is clear de{x})/dyd 2 < 0. Thus, in order to prove 
(22) > 0, it suffices to show de{x^)/dyd 2 < de{x?)/dyd 2 . 

-e(x ) 


i9yd2 


d 

dyd-^ 


K-1 


K-1 


d 


7(x‘))y:A(x‘)‘ + 7(x‘)y:—A(x^ 


i\k 


Pi A Ap dp 


fc=0 

K-1 


fc=0 


fc=0 


.i\k 


(23) 


K-1 


+7(x*)(d^ - 1) H A(x*) 


k-1 


k=l 


As 7 (x^) < 7 (x^) and A(x^) < A(x^), we have from (23) 
the desired inequality de{x})/dyd 2 < de{xP)/dyd 2 . 


Appendix D 
Proof of Theorem|7] 

Let X* = N(m, AT,/?/^) be an NE and y* = 
y*{m, K, Pia) for notational convenience. Also, we write 
e(y*) in place of e(X(y*)). By slightly rewriting the social 
costs given by 0 and ( [T4| ), we obtain 

SC{y*) = {cp - AL Tda) H y^ +tda Lp 

dev 

+tda Lu davg e(y*) - AL tda e(y*) '^d-pd 

d^V 

and 

5C(x*) = (cp — AL Tda) ^ + xda Lu 

dGV 

-{-Tda Lu d^vg e(x*) - AL tda e(x*) ^ d • p. 

d^V 

We first derive an upper bound on the difference SC{x*) — 
SC{y*) followed by a lower bound on SC{y*). 

Subtracting SC{y*) from SC{x*), 

SC{x*) - 5C(y*) 

= (cp - AL tda) ( H x*d,P - H Vd) 

d^T) d^T) 

+AL TDA(e{y*) ^(y^ • d) - e(x*) ^(x^^p • d)) 

dGV d^T> 

+tda Lp davg(e(x*) - e(y*)). 





































COPYRIGHT RESERVED BY RICHARD I. LA 


16 


From Theorems and we know p < yp Hence, 
together with the assumption cp > AL tpa, we get 

^C(x*) - ^(y*) 

< AL TDA{e{y*) ^{Vd ■ d) - e(x*) • d)) 

d^T) d^T> 

+tda Lu davg(e(x*) - e(y*)). (24) 


We consider the following two cases. 

Case 1: e(y*) T^deviVd ' d) > e(x*) 'Edevi^lp ' d) - In 
this case, we have 


^<Lu tda (e(y*) ^ [yl ■ d) - e(x*) ^ {x*dj 

d^'D d^'D 

+tda Lu davg(e(x*) - e(y*)) 

= Lu Tda e(x*)(^davg - '^{x*d^p ■ d)j 

d^V 

-e(y*)(davg - ^iyd-d)j 


d^V 


d)) 


(25) 


From ( |25] l it is clear that the maximum is achieved when x* = 
0 and y* = m. Hence, 


{2i\ < Tda Lu 


davg Cniax {m,K,/3iA)- 


Case 2: e{y*)J2deM ' d) < e{x*)J2dev(.^d,P ' d) - 

Under the assumption, it is obvious 


( |24| ) <tda Lu 
^tda Lu 


davg(e(x*) -e(y*)) 
^avg ^max {m,K,PiA). 


From these two cases, it is clear that 
Tda Lu d^ emax(m, iT,/S/ a) is an upper bound for 
SCi^) - SCiy*). 

Since we assume cp > AL tda, we get the following lower 
bound on SC{y*). 

SC{y*) > Tda Lp + tda e{y*){Lu ■ davg - AL d ■ 


where the second inequality is a consequence of Lp ■ davg > 

A^ X)dGX>■ dd- _ 

Using the above upper bound on SC{x*) — SC{y*) and 
the lower bound on SC{y*), 

SCj^^) _ ^ ^ SC{^^ gc(y*) 

SC{y*) SC{y-) 

^ ^ ^ Tda Lp davg 6;niax(tia, df,/S/ a) 

“ Tda Lp 

— 1 “t” ^avg Cmax(tn; AT, /Sja)- 










